pi-harness-runtime 1.1.398 → 1.1.403

package/packages/jev-judge/dist/question-risk.js

@@ -0,0 +1,105 @@
+/**
+ * The risk facts of a pending question.
+ *
+ * The autonomous decision is only as safe as the facts it is based on: a
+ * question that asks for permission for a destructive or irreversible
+ * action must never be approved while the user is away. The facts are
+ * derived deterministically from the question the agent asked and from the
+ * kind of the question - never from a guess.
+ *
+ * The classifier is deliberately conservative: an uncertain case is
+ * classified as "needs an explicit authorization", so the deterministic
+ * policy waits for a human instead of continuing the work.
+ */
+/**
+ * Words that name an action that destroys, drops or overwrites something.
+ */
+const DESTRUCTIVE_PATTERNS = [
+    { name: "delete", pattern: /\b(delete|remove|drop|truncate|wipe|purge|destroy|erase)\b/ },
+    { name: "reset", pattern: /\b(reset|rollback|revert)\b/ },
+    { name: "revoke", pattern: /\b(revoke|rotate|invalidate)\b/ },
+    { name: "force-push", pattern: /\b(force[\s-]?push|push\s+(--force|-f\b)|reset\s+--hard|clean\s+-\w*f)\b/ },
+    { name: "drop-object", pattern: /\bdrop\s+(table|database|schema|collection|index|bucket)\b/ },
+    { name: "delete-object", pattern: /\bdelete\s+(the\s+)?(database|table|file|folder|branch|tag|user|account|volume|key)\b/ },
+    { name: "terminate", pattern: /\b(terminate|kill|shutdown|stop)\b/ },
+    { name: "overwrite", pattern: /\boverwrite\b/ },
+];
+/**
+ * Words that name an action that reaches the outside world.
+ */
+const EXTERNAL_PATTERNS = [
+    { name: "production", pattern: /\b(production|prod|live)\b/ },
+    { name: "deploy", pattern: /\b(deploy|publish|release|ship)\b/ },
+    { name: "merge-main", pattern: /\bmerge\b.*\b(main|master|develop)\b/ },
+    { name: "notify-people", pattern: /\b(send|post|notify|email|message|announce)\b.*\b(users|customers|clients|everyone|subscribers|team|customer)\b/ },
+    { name: "money", pattern: /\b(payment|purchase|order|invoice|charge|refund|spend|billing)\b/ },
+];
+/**
+ * Words that name a secret or a credential.
+ */
+const SENSITIVE_PATTERNS = [
+    { name: "credentials", pattern: /\b(secret|credential|api[\s-]?key|token|password)\b/ },
+];
+function matchPatterns(text, patterns, signals) {
+    let matched = false;
+    for (const { name, pattern } of patterns) {
+        if (pattern.test(text)) {
+            signals.push(name);
+            matched = true;
+        }
+    }
+    return matched;
+}
+/**
+ * Derive the risk facts of a pending question.
+ *
+ * The rules:
+ *
+ * - A question of kind "explicit" asks for an explicit human authorization.
+ *   Jev never approves it on its own.
+ * - A question of kind "approval" is the agent proposing work. It stays
+ *   auto-approvable as long as nothing in it is risky - that is the whole
+ *   point of the timeout: routine, reversible work continues when the user
+ *   is away.
+ * - A question that names a destructive action is destructive, and its
+ *   reversibility cannot be proven - so it waits.
+ * - A question that reaches the outside world or touches a secret needs a
+ *   human as well.
+ * - A question with an unknown kind or an empty text is uncertain, and an
+ *   uncertain case waits for the human.
+ */
+export function classifyQuestionRisk(input) {
+    const text = (input.text ?? "").toLowerCase();
+    const kind = input.kind;
+    const signals = [];
+    const destructive = matchPatterns(text, DESTRUCTIVE_PATTERNS, signals);
+    const external = matchPatterns(text, EXTERNAL_PATTERNS, signals);
+    const sensitive = matchPatterns(text, SENSITIVE_PATTERNS, signals);
+    // Only an explicitly demanded authorization blocks the autonomous
+    // decision. An "approval" question is the agent proposing work: it
+    // stays auto-approvable unless the wording names a risky action.
+    let requiresExplicitAuthorization = kind === "explicit";
+    // A destructive action never gets an autonomous approval.
+    if (destructive) {
+        requiresExplicitAuthorization = true;
+    }
+    // An action that reaches the outside world or touches a secret needs a
+    // human as well.
+    if (external || sensitive) {
+        requiresExplicitAuthorization = true;
+    }
+    // Unknown kind or unknown text: the action cannot be judged.
+    if (!kind || !text.trim()) {
+        requiresExplicitAuthorization = true;
+        signals.push("unknown-question");
+    }
+    return {
+        requiresExplicitAuthorization,
+        destructive,
+        // A destructive action is not provably reversible.
+        reversible: !destructive,
+        external,
+        signals,
+    };
+}
+//# sourceMappingURL=question-risk.js.map

package/packages/jev-judge/dist/question-risk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"question-risk.js","sourceRoot":"","sources":["../src/question-risk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAoCH;;GAEG;AACH,MAAM,oBAAoB,GAAkB;IAC3C,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,4DAA4D,EAAE;IACzF,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,6BAA6B,EAAE;IACzD,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gCAAgC,EAAE;IAC7D,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,0EAA0E,EAAE;IAC3G,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,4DAA4D,EAAE;IAC9F,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,uFAAuF,EAAE;IAC3H,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,oCAAoC,EAAE;IACpE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE;CAC/C,CAAC;AAEF;;GAEG;AACH,MAAM,iBAAiB,GAAkB;IACxC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,4BAA4B,EAAE;IAC7D,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mCAAmC,EAAE;IAChE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,sCAAsC,EAAE;IACvE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iHAAiH,EAAE;IACrJ,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,kEAAkE,EAAE;CAC9F,CAAC;AAEF;;GAEG;AACH,MAAM,kBAAkB,GAAkB;IACzC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,qDAAqD,EAAE;CACvF,CAAC;AAEF,SAAS,aAAa,CACrB,IAAY,EACZ,QAAuB,EACvB,OAAiB;IAEjB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO,GAAG,IAAI,CAAC;QAChB,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CACnC,KAAwB;IAExB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAEnE,kEAAkE;IAClE,mEAAmE;IACnE,iEAAiE;IACjE,IAAI,6BAA6B,GAAG,IAAI,KAAK,UAAU,CAAC;IAExD,0DAA0D;IAC1D,IAAI,WAAW,EAAE,CAAC;QACjB,6BAA6B,GAAG,IAAI,CAAC;IACtC,CAAC;IAED,uEAAuE;IACvE,iBAAiB;IACjB,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC3B,6BAA6B,GAAG,IAAI,CAAC;IACtC,CAAC;IAED,6DAA6D;IAC7D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3B,6BAA6B,GAAG,IAAI,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClC,CAAC;IAED,OAAO;QACN,6BAA6B;QAC7B,WAAW;QACX,mDAAmD;QACnD,UAAU,EAAE,CAAC,WAAW;QACxB,QAAQ;QACR,OAAO;KACP,CAAC;AACH,CAAC"}

package/packages/jev-judge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-harness/jev-judge",
-  "version": "1.1.398",
+  "version": "1.1.403",
   "description": "Jev Judge - Structured decision model for agent routing, E2E testing, and automated decisions",
   "type": "module",
   "main": "./dist/index.js",

package/packages/jev-judge/src/auto-continue.ts

@@ -23,13 +23,261 @@ export interface TaskState {
   userResponded: boolean;
   lastUserActivity?: Date;
   sessionStartTime: Date;
+  /** The bounded decision context (question, risk, task state). */
+  context?: DecisionContext;
+}
+
+/**
+ * The typed outcome of a decision.
+ *
+ * It is not the same shape as a human answer: an autonomous decision is
+ * never reported as a user "yes".
+ */
+export type DecisionOutcome =
+  | "approve"
+  | "reject"
+  | "wait"
+  | "proceed_with_caution";
+
+/**
+ * The pending question Jev has to decide about.
+ *
+ * Without it Jev can only see progress, not what the agent asked permission
+ * to do.
+ */
+export interface PendingQuestionContext {
+  /** The canonical request ID. */
+  requestId: string;
+  /** The complete question text. */
+  text: string;
+  /** The detected kind of the question. */
+  kind: "routine" | "approval" | "clarification" | "explicit";
+  /** The exact action the agent proposes. */
+  proposedAction?: string;
+  /** What happens when the question is approved. */
+  consequence?: string;
+  /** Does the action need an explicit human authorization? */
+  requiresExplicitAuthorization?: boolean;
+  /** Does the action destroy or overwrite something? */
+  destructive?: boolean;
+  /** Does the action leave the machine (network, mail, deploy)? */
+  external?: boolean;
+  /** Can the action be undone? */
+  reversible?: boolean;
+}
+
+/**
+ * The bounded context of a decision.
+ *
+ * Everything is bounded on purpose: an unbounded todo transcript makes the
+ * evaluation input large and expensive without making it better.
+ */
+export interface DecisionContext {
+  question?: PendingQuestionContext;
+  /** The task the session is working on right now. */
+  currentTask?: string;
+  /** 0..1 */
+  completionRatio?: number;
+  totalTasks?: number;
+  completedTasks?: number;
+  /** What blocks the work. */
+  blockers?: string[];
+  /** The next relevant tasks. */
+  nextTasks?: string[];
+  /** The state of the last validation run. */
+  validationStatus?: string;
+  /** How long the question is already waiting. */
+  waitedMinutes?: number;
+  /** When the decision has to be made. */
+  deadlineMinutes?: number;
+  /** When the user was last active. */
+  lastUserActivity?: Date;
+}
+
+/** How many task titles reach the evaluation. */
+export const MAX_LISTED_TASKS = 10;
+/** How much of the question text reaches the evaluation. */
+export const MAX_QUESTION_CHARS = 2000;
+
+/**
+ * The deterministic part of a decision.
+ *
+ * Jev proposes an outcome, this function decides what is actually allowed.
+ * The rules live in code and not in a prompt: a clarification is never
+ * turned into an approval of a guessed interpretation, and an action that
+ * needs an explicit human authorization or that cannot be undone is never
+ * approved autonomously.
+ */
+export interface DecisionPolicyResult {
+  outcome: DecisionOutcome;
+  /** The rule that changed the outcome, when one did. */
+  appliedRule?: string;
+  reason: string;
+}
+
+export interface DecisionPolicyOptions {
+  /** The confidence an autonomous approval needs. */
+  confidenceThreshold?: number;
+  /** The confidence of the proposed outcome. */
+  confidence?: number;
+}
+
+/**
+ * Is the value a known outcome?
+ *
+ * The evaluation returns the outcome as a free-text choice: an unknown
+ * value is ignored instead of being guessed.
+ */
+export function isDecisionOutcome(value: unknown): value is DecisionOutcome {
+  return (
+    value === "approve" ||
+    value === "reject" ||
+    value === "wait" ||
+    value === "proceed_with_caution"
+  );
+}
+
+/**
+ * Combine the threshold outcome with the structured outcome of the
+ * evaluation.
+ *
+ * The evaluation may only tighten the decision: a rejection stays a
+ * rejection, a wait stays a wait, and an approval never beats the
+ * thresholds.
+ */
+export function tightenOutcome(
+  thresholdOutcome: DecisionOutcome,
+  proposed: DecisionOutcome | undefined,
+): DecisionOutcome {
+  if (!proposed) return thresholdOutcome;
+  if (proposed === "reject") return "reject";
+  if (proposed === "wait") return "wait";
+  if (proposed === "proceed_with_caution") {
+    return thresholdOutcome === "approve" ? "proceed_with_caution" : thresholdOutcome;
+  }
+  // The evaluation proposed an approval: the thresholds keep their veto.
+  return thresholdOutcome === "wait" ? "wait" : thresholdOutcome;
+}
+
+/**
+ * Are the risk facts of the proposed action unknown?
+ *
+ * A question without a kind and without a single known risk fact cannot be
+ * judged: the policy waits for the human instead of continuing on a guess.
+ */
+export function hasUnknownRiskFacts(question: PendingQuestionContext): boolean {
+  if (!question.kind) return true;
+  return (
+    question.requiresExplicitAuthorization === undefined &&
+    question.destructive === undefined &&
+    question.reversible === undefined
+  );
+}
+
+export function applyDecisionPolicy(
+  proposed: DecisionOutcome,
+  context: DecisionContext | undefined,
+  options?: DecisionPolicyOptions,
+): DecisionPolicyResult {
+  const question = context?.question;
+
+  if (proposed === "approve" || proposed === "proceed_with_caution") {
+    if (question?.kind === "clarification") {
+      return {
+        outcome: "wait",
+        appliedRule: "clarification-never-approved",
+        reason:
+          "A clarification asks which option is meant. Guessing it would decide for the user.",
+      };
+    }
+
+    if (question?.requiresExplicitAuthorization) {
+      return {
+        outcome: "wait",
+        appliedRule: "explicit-authorization-required",
+        reason: "The action needs an explicit human authorization.",
+      };
+    }
+
+    if (question?.destructive && question.reversible === false) {
+      return {
+        outcome: "wait",
+        appliedRule: "irreversible-action",
+        reason: "The action cannot be undone, so it waits for the user.",
+      };
+    }
+
+    if (question?.destructive) {
+      return {
+        outcome: "proceed_with_caution",
+        appliedRule: "destructive-action",
+        reason: "The action is destructive but reversible, so it proceeds with caution.",
+      };
+    }
+
+    // Nothing is known about the risk of the action: an uncertain case
+    // waits for the human instead of continuing on a guess.
+    if (question && hasUnknownRiskFacts(question)) {
+      return {
+        outcome: "wait",
+        appliedRule: "unknown-risk-facts",
+        reason:
+          "The risk of the proposed action is unknown, so it waits for the user.",
+      };
+    }
+
+    const threshold = options?.confidenceThreshold ?? 0.7;
+    const confidence = options?.confidence;
+    if (typeof confidence === "number" && confidence < threshold) {
+      return {
+        outcome: "wait",
+        appliedRule: "confidence-below-threshold",
+        reason: `The confidence ${confidence.toFixed(2)} is below the threshold ${threshold.toFixed(2)}.`,
+      };
+    }
+  }
+
+  return { outcome: proposed, reason: "No policy rule applied." };
+}
+
+/**
+ * What the runtime does with a Jev outcome.
+ *
+ * - `continue`: the work resumes with a steer to the agent.
+ * - `pause`: the work stops and waits for a human.
+ * - `discard`: the decision was stale and must not change anything.
+ * - `wait`: the question stays open for a later decision.
+ */
+export type OutcomeApplication = "continue" | "pause" | "discard" | "wait";
+
+/**
+ * Decide what a Jev outcome means for the running work.
+ *
+ * `requestClosed` tells whether the pending question was still open and
+ * could be closed with the Jev decision. A closed question is the only
+ * proof that nobody answered in the meantime: when the request was already
+ * answered by a human the Jev decision is stale, and a stale decision must
+ * never continue the work.
+ *
+ * The rule is deterministic: only a successfully closed request may continue
+ * or pause the work, and a rejection never continues it.
+ */
+export function decideOutcomeApplication(
+  outcome: DecisionOutcome,
+  requestClosed: boolean,
+): OutcomeApplication {
+  if (outcome === "wait") return "wait";
+  if (!requestClosed) return "discard";
+  return outcome === "reject" ? "pause" : "continue";
 }
 
 /**
  * Auto-continue decision
  */
 export interface AutoContinueDecision {
-  action: "proceed" | "wait" | "proceed_with_caution";
+  action: "proceed" | "wait" | "proceed_with_caution" | "reject";
+  /** The typed outcome after the policy was applied. */
+  outcome: DecisionOutcome;
   probability: number; // 0-1 confidence to proceed
   riskLevel: "minimal" | "low" | "medium" | "high" | "critical";
   reasoning: string;
@@ -37,6 +285,8 @@ export interface AutoContinueDecision {
   estimatedImpact: "minimal" | "moderate" | "significant" | "major";
   confidence: "high" | "medium" | "low";
   waitRecommendation?: number; // minutes to wait if action is "wait"
+  /** The policy rule that changed the outcome, when one did. */
+  policyApplied?: string;
 }
 
 /**
@@ -92,6 +342,19 @@ export class AutoContinueJudge {
 
     try {
       const result = await this.jev.evaluate(state, {
+        outcome: {
+          type: "choice",
+          instructions:
+            "The decision for the pending question. Reject it when the proposed action must not happen.",
+          options: ["approve", "proceed_with_caution", "wait", "reject"],
+          optionDescriptions: {
+            approve: "the agent may continue with the planned work",
+            proceed_with_caution:
+              "the agent may continue, but reports every significant step",
+            wait: "keep waiting for the user, the question stays open",
+            reject: "the proposed action must not happen, the work pauses",
+          },
+        },
         shouldProceed: {
           type: "noul",
           instructions:
@@ -153,11 +416,52 @@ export class AutoContinueJudge {
         },
       });
 
-      return this.buildDecision(result, taskState);
+      return this.applyPolicy(this.buildDecision(result, taskState), taskState);
     } catch (error) {
       logError("[AutoContinueJudge]", `Jev call failed: ${error}`);
-      return this.fallbackDecision(taskState);
+      return this.applyPolicy(this.fallbackDecision(taskState), taskState);
+    }
+  }
+
+  /**
+   * Apply the deterministic policy to a proposed decision.
+   *
+   * The policy is code, not a prompt: it decides what is actually allowed,
+   * and it records which rule changed the outcome.
+   */
+  private applyPolicy(
+    decision: AutoContinueDecision,
+    taskState: TaskState,
+  ): AutoContinueDecision {
+    const policy = applyDecisionPolicy(decision.outcome, taskState.context, {
+      confidenceThreshold: this.config.proceedThreshold,
+      confidence: decision.probability,
+    });
+
+    decision.outcome = policy.outcome;
+
+    if (policy.appliedRule) {
+      decision.policyApplied = policy.appliedRule;
+      decision.reasoning = `${decision.reasoning} - ${policy.reason}`;
     }
+
+    if (policy.outcome === "wait" && decision.action !== "wait") {
+      decision.action = "wait";
+      decision.waitRecommendation =
+        decision.waitRecommendation ?? this.config.maxWaitMinutes;
+    }
+
+    if (policy.outcome === "proceed_with_caution" && decision.action === "proceed") {
+      decision.action = "proceed_with_caution";
+    }
+
+    // A rejection is never downgraded: the work pauses and waits for a
+    // human.
+    if (policy.outcome === "reject") {
+      decision.action = "reject";
+    }
+
+    return decision;
   }
 
   /**
@@ -169,7 +473,8 @@ export class AutoContinueJudge {
     const result = await this.decide(taskState);
 
     return {
-      shouldContinue: result.action !== "wait",
+      shouldContinue:
+        result.action === "proceed" || result.action === "proceed_with_caution",
       probability: result.probability,
       confidence: result.confidence,
     };
@@ -179,30 +484,7 @@ export class AutoContinueJudge {
    * Build state for Jev
    */
   private buildState(taskState: TaskState): string {
-    const completionPercent = Math.round(
-      (taskState.completedTasks.length / taskState.totalTasks) * 100
-    );
-
-    const state = {
-      task_summary: {
-        completed: taskState.completedTasks.length,
-        remaining: taskState.remainingTasks.length,
-        total: taskState.totalTasks,
-        completion_percent: completionPercent,
-        completed_list: taskState.completedTasks,
-        remaining_list: taskState.remainingTasks,
-      },
-      user_status: {
-        responded: taskState.userResponded,
-        wait_time_minutes: taskState.waitTimeMinutes,
-        last_activity: taskState.lastUserActivity?.toISOString() ?? "unknown",
-        session_duration_minutes: Math.round(
-          (Date.now() - taskState.sessionStartTime.getTime()) / 60000
-        ),
-      },
-    };
-
-    return JSON.stringify(state, null, 2);
+    return JSON.stringify(buildDecisionState(taskState), null, 2);
   }
 
   /**
@@ -231,6 +513,15 @@ export class AutoContinueJudge {
 
     const waitBenefit = (result.decisions.waitBenefit?.response as { noul: number })?.noul ?? 0.5;
 
+    // The structured outcome of the evaluation. It can make the decision
+    // stricter (reject, wait) but never looser than the thresholds allow.
+    const outcomeChoice = (
+      result.decisions.outcome?.response as { choice?: string } | undefined
+    )?.choice;
+    const proposedOutcome = isDecisionOutcome(outcomeChoice)
+      ? outcomeChoice
+      : undefined;
+
     // Determine action based on thresholds
     let action: AutoContinueDecision["action"];
     let confidence: AutoContinueDecision["confidence"];
@@ -254,6 +545,31 @@ export class AutoContinueJudge {
       reasoning = `Waiting recommended (${((1 - probability) * 100).toFixed(0)}% confidence to wait)`;
     }
 
+    let outcome: DecisionOutcome =
+      action === "proceed"
+        ? "approve"
+        : action === "proceed_with_caution"
+          ? "proceed_with_caution"
+          : "wait";
+
+    // The outcome of the evaluation may only tighten the decision: a
+    // rejection stays a rejection, a wait stays a wait, and an approval
+    // never beats the thresholds.
+    outcome = tightenOutcome(outcome, proposedOutcome);
+    if (outcome === "reject") {
+      action = "reject";
+      confidence = probability > 0.85 ? "high" : "medium";
+      reasoning = `Jev rejected the proposed action (${(probability * 100).toFixed(0)}% confidence to proceed)`;
+    } else if (outcome === "wait" && proposedOutcome === "wait") {
+      action = "wait";
+      reasoning = "Jev decided to wait for the user";
+    } else if (outcome === "proceed_with_caution" && proposedOutcome === "proceed_with_caution") {
+      action = "proceed_with_caution";
+    } else if (proposedOutcome === "approve" && outcome === "wait") {
+      // The thresholds keep their veto: a low confidence stays a wait.
+      reasoning = `${reasoning} - Jev proposed an approval, the confidence stays below the threshold`;
+    }
+
     // Calculate recommended wait time
     let waitRecommendation: number | undefined;
     if (action === "wait") {
@@ -265,6 +581,7 @@ export class AutoContinueJudge {
 
     return {
       action,
+      outcome,
       probability,
       riskLevel,
       reasoning,
@@ -296,6 +613,7 @@ export class AutoContinueJudge {
     if (completionPercent >= 0.8 && taskState.waitTimeMinutes >= 15) {
       return {
         action: "proceed_with_caution",
+        outcome: "proceed_with_caution",
         probability: 0.6,
         riskLevel: "medium",
         reasoning: "Fallback: high completion, waited long time",
@@ -308,6 +626,7 @@ export class AutoContinueJudge {
 
     return {
       action: this.config.fallbackAction,
+      outcome: "wait",
       probability: 0.5,
       riskLevel: "medium",
       reasoning: "Fallback: Jev unavailable, using default behavior",
@@ -319,6 +638,82 @@ export class AutoContinueJudge {
   }
 }
 
+/**
+ * Is the question old enough for an autonomous decision?
+ *
+ * The threshold belongs to the caller: the judge is only asked once the
+ * question waited long enough.
+ */
+export function isEligibleForDecision(
+  waitedMinutes: number,
+  minWaitMinutes: number
+): boolean {
+  return waitedMinutes >= minWaitMinutes;
+}
+
+/**
+ * The bounded evaluation input of a decision.
+ *
+ * It carries the question Jev has to decide about, the risk of the proposed
+ * action and the relevant task state - and nothing that grows without a
+ * bound.
+ */
+export function buildDecisionState(taskState: TaskState): Record<string, unknown> {
+  const completionPercent = Math.round(
+    (taskState.completedTasks.length / taskState.totalTasks) * 100
+  );
+
+  const context = taskState.context;
+  const question = context?.question;
+
+  return {
+    task_summary: {
+      completed: taskState.completedTasks.length,
+      remaining: taskState.remainingTasks.length,
+      total: taskState.totalTasks,
+      completion_percent: completionPercent,
+      // Bounded: the evaluation input stays small, the most recent
+      // completions and the first remaining tasks are the relevant ones.
+      completed_list: taskState.completedTasks.slice(-MAX_LISTED_TASKS),
+      remaining_list: taskState.remainingTasks.slice(0, MAX_LISTED_TASKS),
+    },
+    user_status: {
+      responded: taskState.userResponded,
+      wait_time_minutes: taskState.waitTimeMinutes,
+      last_activity: taskState.lastUserActivity?.toISOString() ?? "unknown",
+      session_duration_minutes: Math.round(
+        (Date.now() - taskState.sessionStartTime.getTime()) / 60000
+      ),
+    },
+    // The question Jev decides about. Without it Jev only sees progress.
+    pending_question: question
+      ? {
+          request_id: question.requestId,
+          kind: question.kind,
+          text: question.text.slice(0, MAX_QUESTION_CHARS),
+          proposed_action: question.proposedAction ?? "unknown",
+          consequence_of_approval: question.consequence ?? "unknown",
+          // The risk facts are unknown when they were not determined: an
+          // unknown fact is reported as unknown and never as "harmless".
+          requires_explicit_authorization:
+            question.requiresExplicitAuthorization ?? "unknown",
+          destructive: question.destructive ?? "unknown",
+          external_effect: question.external ?? "unknown",
+          reversible: question.reversible ?? "unknown",
+        }
+      : null,
+    decision_context: {
+      current_task: context?.currentTask ?? "unknown",
+      completion_ratio: context?.completionRatio ?? completionPercent / 100,
+      blockers: (context?.blockers ?? []).slice(0, MAX_LISTED_TASKS),
+      next_tasks: (context?.nextTasks ?? []).slice(0, MAX_LISTED_TASKS),
+      validation_status: context?.validationStatus ?? "unknown",
+      waited_minutes: context?.waitedMinutes ?? taskState.waitTimeMinutes,
+      deadline_minutes: context?.deadlineMinutes ?? null,
+    },
+  };
+}
+
 /**
  * Helper: Create task state from todo list
  */
@@ -326,7 +721,8 @@ export function createTaskState(
   completedTasks: string[],
   remainingTasks: string[],
   lastUserActivity?: Date,
-  sessionStartTime?: Date
+  sessionStartTime?: Date,
+  context?: DecisionContext
 ): TaskState {
   const totalTasks = completedTasks.length + remainingTasks.length;
 
@@ -340,5 +736,6 @@ export function createTaskState(
     userResponded: false,
     lastUserActivity,
     sessionStartTime: sessionStartTime ?? new Date(),
+    context,
   };
 }

package/packages/jev-judge/src/index.ts

@@ -697,6 +697,10 @@ export { DecisionEngine } from "./decision-engine.js";
 export { AutoContinueJudge, createTaskState } from "./auto-continue.js";
 export type { TaskState, AutoContinueDecision, AutoContinueConfig } from "./auto-continue.js";
 
+// Export the deterministic risk classifier of a pending question
+export { classifyQuestionRisk } from "./question-risk.js";
+export type { QuestionRiskFacts, QuestionRiskInput } from "./question-risk.js";
+
 // Export WrapUpJudge
 export { checkWrapUp, getTodoSummary } from "./wrap-up-judge.js";
 export type { WrapUpResult } from "./wrap-up-judge.js";